The Health Care Industry Cybersecurity (HCIC) Task Force was established by the Department of Health and Human Services (HHS) in March 2016 per the Cybersecurity Act of 2015, Section 405(c). EHNAC applauds HHS and the expert panel of subject matter experts on the HCIC Task Force who contributed to develop these recommendations to strengthen the privacy and security of U.S. healthcare data. The pace of technology is rapidly changing which coincides with increased threats and actual breach incidents occurring.

“The incidence of cyberattacks across healthcare have more than doubled in the last five years, and it’s estimated that data breaches cost the healthcare industry $6.2 billion annually,” said Lee Barrett, executive director, EHNAC. “This report – and most importantly its recommendations for action contained in Appendix A – together with the National Institute of Standards and Technology (NIST) framework, and the important work of accrediting and certification bodies such as HITRUST and EHNAC, can collectively contribute to transform the HCIC recommendations into attainable and operational actions across the healthcare industry.”

Most importantly, the HCIC has identified within the report and recommendations the following premises:

Solutions must be appropriate for all healthcare organizations from the smallest single provider office to the most sophisticated and regulated business environment. EHNAC’s multiple accreditation programs specialize in being flexible and scalable, whether dealing with a small office or a complex business.

Many regulations and best practices (including but not limited to HIPAA, ISO, NIST, FEDRAMP and others) already set forth methods to strengthen data protection. These should be further leveraged to apply to cybersecurity risk in areas that are not currently subject to such regulations (such as the Internet of Things and current wearable health/medical devices). In this mode, current standards and proven best practices could be extended. Much of the effort ahead is based upon our ability to identify those standards and best practices across our industry and communicate and educate others effectively about them.

Specific examples where the HCIC Report recommends scalability are as follows:

Recommendation 1.2 Action Item 1.2.3 – Industry and government should partner to establish an evaluation mechanism and prioritized best practices to support the range of small to large organizations to consistently apply the NIST Cybersecurity Framework.

EHNAC was founded in 1993 and is a tax-exempt 501(c)(6) nonprofit organization. Guided by peer evaluation, the EHNAC accreditation process promotes quality service, innovation, cooperation and open competition in healthcare. To learn more, visit www.ehnac.org, contact info@ehnac.org, or follow us on Twitter, LinkedIn and YouTube.